Postfix How To: Standalone mail server with webmail only.

by CacTus

What is postfix?

Well, I think the postfix website gives a good enough definition for our purposes.

"Postfix attempts to be fast, easy to administer, and secure, while at the same time being sendmail
compatible enough to not upset existing users. Thus, the outside has a sendmail-ish flavor, but the
inside is completely different."
-- http://www.postfix.org/

Goals

The goal of this how to is to setup postfix for virtual mailbox delivery only. There will be no delivery to user accounts on the box (/etc/passwd). Further, access will only be available via a web mail frontend (squirrelmail), no direct pop3 or imap access will be granted.
It should be fairly easy to allow those additional features given the information below, but it is not within the scope of this document.

Required packages:

postfix (compiled for mysql support)

courier-imap

squirrelmail

mysql

apache

ssl

If you have trouble finding a package specific to this How-To, try the resources link at the bottom.

Postfix Installation

Step 1: Install Postfix

[[root@computer]]$ pacman -Sy postfix

Step 2: Check /etc/passwd, /etc/group

Make sure that the following shows up in /etc/passwd

postfix:x:73:73::/var/spool/postfix:/bin/false

Make sure that the following shows up in /etc/group

postdrop:x:75:
postfix:x:73:

Note: Postfix can be made to run in a chroot. This document does not currently cover this. Might be added later.

Postfix Configuration

Step 1: Ensure DNS setup

For mail delivery on the internet, your dns must be correct. An MX record should point to the mail host.
It should be noted that some mail servers will not deliver mail to you if your MX record points to a CNAME. For best results, always point an MX record to an A record definition.
More info about DNS and records, is beyond the scope of this document.

Step 2: /etc/postfix/master.cf

I don't pretend to fully understand this file yet. More info on this to come. I am studying. wink

Step 3: /etc/postfix/main.cf

Step 3.1 myhostname

set myhostname if your mail server has multiple domains, and you do not want the primary domain to be the mail host. The default is to use the result of a gethostname() call if nothing is specified.
For our purposes we will just set it as follows:

myhostname = mail.nospam.net

This is assuming that a DNS A record, and an MX record both point to mail.nospam.net

Step 3.2 mydomain

this is usually the value of myhostname, minus the first part. If your domain is wonky, then just set it manually.

mydomain = nospam.net

Step 3.3 myorigin

this is where the email will be seen as being sent from. I usually set this to the value of mydomain. For simple servers, this works fine. This is for mail originating from a local account. Since we are not doing local delivery (except sending), then this is not really as important as it normally would be.

myorigin = $mydomain

Step 3.4 mydestination

This is the lookup for local users. Since we are not going to deliver internet mail for any local users, set this to localhost only.

mydestination = localhost

Step 3.5 mynetworks and mynetwork_style

Both of these control relaying, and whom is allowed to. We do not want any relaying.
For our sakes, we will simply set mynetwork_style to host, as we are trying to make a standalone postfix host, that people with use webmail on. No relaying, no other MTA's. Just webmail.

mynetwork_style = host

Step 3.6 relaydomains

This controls the destinations that postfix will relay TO. The default value is $mydestination. This should be fine for now.

relaydomains = $mydestination

Step 3.7 home_mailbox

This setting controls how mail is stored for the users.
Set this to \"Maildir/\", as courier IMAP requires Maildir style mail storage. This is a good thing. Maildir format mailboxes remove the possible race conditions that can occur with old style mbox formats. No more need to deal with file locking. The '/' at the end is REQUIRED.

home_mailbox = Maildir/

Step 3.8 virtual_mail

Virtual mail is mail that does not map to a user account (/etc/passwd). This is where all the email for the system will be kept. We are not doing local delivery, remember, so if you wan't a user that has the same name as a local user, just make a virtual account with the same name.
First thing we need to do is add the following:

virtualmailboxdomains is a list of the domains that you want to receive mail for. This CANNOT be the same thing that is listed in mydestination. That is why we left mydestination to be localhost only.
virtualmailboxmaps will contain the info about the virtual users and their mailbox locations. We are using a hash file to store the more permanent maps, and these will override the forwards in the mysql database.

virtualmailboxbase is the base dir where the virtual mailboxes will be stored.
The gid and uid maps are the real system user account that the virtual mail will be owned by. This is for storage purposes. Since we will be using a web interface, and don't want people accessing this by any other means, we will be creating this account later with no login access.
Virtualmailboxlimit controls the size of the mailbox. I don't know how well this works yet. I have set the size above to about 50MB.

Step 4. /etc/postfix/aliases

We need to map some aliases to real accounts. The default setup by arch looks pretty good here. =D
Uncomment the following line, and change it to a real account. I put the user account on the box that I use. Best not to just send mail to root, because you don't want to be logging in as root or checking email as root. Not good. Sudo is your friend, and so is forwarding root mail. Since this is for local delivery only (syslogs and stuff), it is still within the realm of mydestination.

root: cactus

Once you have finished editing /etc/postfix/aliases you must run the postalias command.

Step 9. postfix check

Run the postfix check command. It should output anything that you might have done wrong in a config file. To see all of your configs, type postconf. To see how you differ from the defaults, try postconf -n

Step 10. /etc/rc.conf

Add postfix to the list of daemons. Put it near the right side, after iptables and network.
Put it after mysqld, as we are going to be using mysql for some of the virtual domain information storage. It is also best to put it before httpd, as it might be possible, however unlikely, for a webmail user to try something before postfix has fully started.

The key is the last entry. This is an actual email. If you see that, it is working.

Courier IMAP Installation

Step 1: Install Courier IMAP

pacman -Sy courier-imap courier-imap-mysql

Configure Courier IMAP

Step 1: /etc/courier-imap/imapd

ADDRESS=127.0.0.1

We set the listen address to LOCAL ONLY. No outside connections.

Step 2: /etc/courier-imap/authdaemonrc

authmodulelist=\"authmysql\"

Step 3: /etc/courier-imap/authmysqlrc

MYSQL_SERVER localhost
MYSQL_USERNAME dbuser
MYSQL_PASSWORD secretpass!
MYSQL_SOCKET /tmp/mysql.sock
MYSQL_DATABASE dbname
MYSQL''USER''TABLE users
MYSQL''CLEAR''PWFIELD password
MYSQL''UID''FIELD '5003'
##note, this is the uid that we set in /etc/postfix/main.cf
MYSQL''GID''FIELD '5003'
##note, this is the gid that we set in /etc/postfix/main.cf
MYSQL''LOGIN''FIELD email
MYSQL''HOME''FIELD \"/home/vmailer\"
MYSQL''MAILDIR''FIELD concat(domain,'/',email,'/')
MYSQL''QUOTA''FIELD quota

Step 6: /etc/conf.d/courier-imap

First start the courier-imap daemon then stop it right away. I don't know exactly what this does (if anything.lol), but I have attempted the following step without having fulfilled that precondition and it borked on me. shrug
A quick

/etc/rc.d/courier-imap start
/etc/rc.d/courier-imap stop

should be enough.
Now, remove the pop3d listings from courier-imap. We are only using the imap facility. Since the daemon is local only (localhost), we do not need the ssl imapd server either.
/etc/conf.d/courier-imap

Step 1.3: Generate a certificate

Step 1.4: Restart apache and test

Make sure that https is now working, and that you can get to the secure site.

Step 2: Put squirrelmail in the directory you created

Either extract squirrelmail, or move it from where the arch package puts it, into the directory you created for the secure http site.

Step 3: Run squirrelmail config utility

cd 'squirrelmaildir'/config

perl conf.pl

Make sure you select 'D', then type in courier and hit enter. Make sure your other options are correct as well.
Note: If you use php with safe mode on, make sure that the data dir is owned by the same owner as all the files in the squirrelmail directory. With safe mode off, simply follow the squirrelmail setup directions.

Step 4: Test the squirrelmail setup

Log in with the test account. You will need to login with the form of:
username: cactus@virtualdomain.tld
password: secret

Try sending email to non-existent local accounts. You should get an immediate bounce back.
Try sending email to external good email accounts, as well as non-existent ones.
Just general testing stuff.
If everything works fine, then you can add other accounts to the mysql database, and away you go!